« Volver al listado

CVE-2025-32026

Estado: AplazadaBaja (3.8)—

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Element — Element CallAIElement — Element WEBAIMatrix — React SDKAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32026",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32026",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-08T20:02:07.589546Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.8,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "element-hq",
          "product": "element-web",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.11.16, < 1.11.97"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-08T16:15:28.023",
  "references": [
    {
      "url": "https://github.com/element-hq/element-web/security/advisories/GHSA-69q3-jg79-cg79",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem."
    },
    {
      "lang": "es",
      "value": "Element Web es un cliente web de Matrix desarrollado con el SDK de Matrix React. Element Web, desde la versión 1.11.16 hasta la 1.11.96, puede configurarse para cargar una llamada de Element desde una URL externa. En ciertas circunstancias, la página externa puede acceder a las claves de cifrado de medios utilizadas para una llamada de Element. La versión 1.11.97 soluciona este problema."
    }
  ],
  "lastModified": "2026-06-17T09:11:20.593",
  "sourceIdentifier": "security-advisories@github.com"
}